China Hijacks Captive Portals to Spy on Asian Diplomats

Google researchers have linked the Mustang Panda espionage group to a campaign in which captive portal checks are hijacked to deliver malware disguised as Adobe plug‑ins. The activity, observed against Southeast Asian diplomats and other entities worldwide, is believed to have run roughly between March and July this year, with around two dozen victims confirmed by Google’s Threat Intelligence Group.

According to Google, the attackers infected edge devices in target networks to intercept browser checks and redirect users to a site they controlled, which displayed a fake plugin update page but carried malware signed with a valid certificate. The infection chain culminated in the installation of a final payload linked to PlugX, with first-stage code signed by Chengdu Nuoxin Times Technology Co. Ltd. and later utilities such as CANONSTAGER used to deploy the backdoor known as SOGU[.]SEC.

The overall operation also involved compromising edge devices, dynamic DLL loading, and a deliberate effort to appear legitimate by leveraging TLS certificates and trusted software signatures, a pattern that Google notes is unusual for this group.